Hunt.io Reports MeshCentral Abuse Against Thai Operator 3BB
Hunt.io said it observed an active intrusion against Thai broadband operator 3BB on 3 June 2026. Researchers reported root-level control of multiple internal servers and targeting of the 3BB RADIUS authentication database.
Threat intelligence firm Hunt.io reported an intrusion against 3BB, a major Thai broadband operator, after observing the activity on 3 June 2026. Hunt.io associated the campaign with an internet-facing control server that held tooling and an inventory of controlled hosts. The firm concluded that the operations originated from inside the 3BB network and that attackers had full administrative control of multiple core servers. The stated objective was collection of subscriber internet credentials.
What Hunt.io said it observed
Hunt.io described the case as an active campaign. The exposed control server supplied evidence of tooling and of hosts already under control. Several core internal servers were reported at root-level control, with additional internal systems reached from those hosts.
3BB is a large Thai broadband provider. Hunt.io also reported a valid 3BB VPN certificate and Jasmine network login sessions on the same server. The firm noted that Jasmine and 3BB share infrastructure, and it assessed both environments as in scope, with continued risk.
No victim statement, CVE identifier, CVSS score, or vendor patch list appeared in the 16 September 2026 source item.
Legitimate administration software used for persistence
Hunt.io reported that operators used MeshCentral, a free remote-administration product used for ordinary IT operations, as the primary persistence mechanism. The firm did not identify a custom malware family as the main implant. Hunt.io said compromised internal 3BB devices were placed in a control group labeled TH-3BB and were pointed at the domain www.ayuthayatech[.]com.
Hunt.io also reported that logs and ancillary tooling were removed on compromised hosts while MeshCentral remained installed.
Internal impact and RADIUS targeting
Hunt.io reported unauthorized SSH access to more than 55 internal endpoints, collection of database accounts and SSH keys from compromised hosts, reconnaissance of the internal sales portal agent.3bb.co[.]th, and additional persistence on those hosts, including web shells and extra SSH keys.
Hunt.io said the operators targeted the 3BB RADIUS authentication database. That database stores broadband subscriber account names and passwords and was described as core sensitive data. Hunt.io confirmed targeting of the database. Hunt.io did not confirm that subscriber records had been exfiltrated or publicly leaked.
Operator notes in the source
Hunt.io presented the case as unauthorized use of trusted administration software inside a large national broadband network. The firm advised operators of critical infrastructure to limit privileges for remote-administration products and to watch for unusual remote-administration sessions. The source item did not publish detection signatures, configuration steps, or reproduction procedures.